CVE-2026-13246

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attributes of the 'givewp_campaign_comments' shortcode in versions up to, and including, 4.16.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render(), where the blockId value is interpolated directly into a single-quoted HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Actions/RegisterCampaignShortcodes.php#L30
• https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Blocks/CampaignComments/Controller/BlockRenderController.php#L23
• https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Blocks/CampaignComments/render.php#L20
• https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L17
• https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L78
• https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Actions/RegisterCampaignShortcodes.php#L30
• https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Blocks/CampaignComments/Controller/BlockRenderController.php#L23
• https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Blocks/CampaignComments/render.php#L20
• https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L17
• https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L78
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3590193%40give&new=3590193%40give&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/08f8f489-6b31-45d8-a122-bbaa283a2b10?source=cve

Published

Jul 1, 2026

Last Modified

Jul 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13240Missing Authorization vulnerability in Drupal Paragraphs all…6.5
• CVE-2026-13241Missing Authorization vulnerability in Drupal Paragraphs all…6.5
• CVE-2026-13242Improper Neutralization of Special Elements used in an SQL C…6.5
• CVE-2026-13243Cross-Site Request Forgery (CSRF) vulnerability in Drupal Sa…4.8
• CVE-2026-13244Improperly Controlled Modification of Dynamically-Determined…8.1
• CVE-2026-13245The MaxButtons – Create buttons plugin for WordPress is vuln…6.1
• CVE-2026-13247The Logo Slider – Logo Carousel, Client Logo Slider & Brand …6.4
• CVE-2026-1325A security flaw has been discovered in Sangfor Operation and…9.8
• CVE-2026-13250The Solace Extra plugin for WordPress is vulnerable to autho…5.3
• CVE-2026-13251The Perfmatters plugin for WordPress is vulnerable to Direct…7.5
• CVE-2026-13252The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, N…6.4
• CVE-2026-13253The Ultimate Post plugin for WordPress is vulnerable to Stor…6.4